Skip to content

1.10.0

Choose a tag to compare

View all tags
@cf-buildpacks-eng cf-buildpacks-eng released this 23 May 14:55
· 331 commits to main since this release
1.10.0
dd64c17

Notably, this release addresses:

USN-6099-1 USN-6099-1: ncurses vulnerabilities:

  • CVE-2019-17594: There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
  • CVE-2019-17595: There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
  • CVE-2021-39537: An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.
  • CVE-2022-29458: ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
  • CVE-2023-29491: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
  • CVE-2021-39537: An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.
  • CVE-2023-29491: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
  • CVE-2022-29458: ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
  • CVE-2019-17594: There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
  • CVE-2019-17595: There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
-ii  cpp-11                 11.3.0-1ubuntu1~22.04   amd64 GNU C preprocessor
+ii  cpp-11                 11.3.0-1ubuntu1~22.04.1 amd64 GNU C preprocessor
-ii  dpkg                   1.21.1ubuntu2.1         amd64 Debian package management system
-ii  dpkg-dev               1.21.1ubuntu2.1         all   Debian package development tools
+ii  dpkg                   1.21.1ubuntu2.2         amd64 Debian package management system
+ii  dpkg-dev               1.21.1ubuntu2.2         all   Debian package development tools
-ii  g++-11                 11.3.0-1ubuntu1~22.04   amd64 GNU C++ compiler
+ii  g++-11                 11.3.0-1ubuntu1~22.04.1 amd64 GNU C++ compiler
-ii  gcc-11                 11.3.0-1ubuntu1~22.04   amd64 GNU C compiler
-ii  gcc-11-base:amd64      11.3.0-1ubuntu1~22.04   amd64 GCC, the GNU Compiler Collection (base package)
+ii  gcc-11                 11.3.0-1ubuntu1~22.04.1 amd64 GNU C compiler
+ii  gcc-11-base:amd64      11.3.0-1ubuntu1~22.04.1 amd64 GCC, the GNU Compiler Collection (base package)
-ii  libasan6:amd64         11.3.0-1ubuntu1~22.04   amd64 AddressSanitizer -- a fast memory error detector
+ii  libasan6:amd64         11.3.0-1ubuntu1~22.04.1 amd64 AddressSanitizer -- a fast memory error detector
-ii  libdpkg-perl           1.21.1ubuntu2.1         all   Dpkg perl modules
+ii  libdpkg-perl           1.21.1ubuntu2.2         all   Dpkg perl modules
-ii  libgcc-11-dev:amd64    11.3.0-1ubuntu1~22.04   amd64 GCC support library (development files)
+ii  libgcc-11-dev:amd64    11.3.0-1ubuntu1~22.04.1 amd64 GCC support library (development files)
-ii  libncurses-dev:amd64   6.3-2                   amd64 developer's libraries for ncurses
-ii  libncurses5-dev:amd64  6.3-2                   amd64 transitional package for libncurses-dev
-ii  libncurses6:amd64      6.3-2                   amd64 shared libraries for terminal handling
-ii  libncursesw6:amd64     6.3-2                   amd64 shared libraries for terminal handling (wide character support)
+ii  libncurses-dev:amd64   6.3-2ubuntu0.1          amd64 developer's libraries for ncurses
+ii  libncurses5-dev:amd64  6.3-2ubuntu0.1          amd64 transitional package for libncurses-dev
+ii  libncurses6:amd64      6.3-2ubuntu0.1          amd64 shared libraries for terminal handling
+ii  libncursesw6:amd64     6.3-2ubuntu0.1          amd64 shared libraries for terminal handling (wide character support)
-ii  libstdc++-11-dev:amd64 11.3.0-1ubuntu1~22.04   amd64 GNU Standard C++ Library v3 (development files)
+ii  libstdc++-11-dev:amd64 11.3.0-1ubuntu1~22.04.1 amd64 GNU Standard C++ Library v3 (development files)
-ii  libtinfo6:amd64        6.3-2                   amd64 shared low-level terminfo library for terminal handling
+ii  libtinfo6:amd64        6.3-2ubuntu0.1          amd64 shared low-level terminfo library for terminal handling
-ii  libtsan0:amd64         11.3.0-1ubuntu1~22.04   amd64 ThreadSanitizer -- a Valgrind-based detector of data races (runtime)
+ii  libtsan0:amd64         11.3.0-1ubuntu1~22.04.1 amd64 ThreadSanitizer -- a Valgrind-based detector of data races (runtime)
-ii  ncurses-base           6.3-2                   all   basic terminal type definitions
-ii  ncurses-bin            6.3-2                   amd64 terminal-related programs and man pages
+ii  ncurses-base           6.3-2ubuntu0.1          all   basic terminal type definitions
+ii  ncurses-bin            6.3-2ubuntu0.1          amd64 terminal-related programs and man pages
Assets 3
Loading